Network Policies & Security

Snowflake provides a comprehensive layered security model. Beyond Role-Based Access Control (RBAC), Snowflake gives administrators control over which networks can connect to an account, how traffic is routed, how data is encrypted, and how users authenticate. This module covers all network and security features tested in the COF-C02 exam.

The Snowflake Security Model at a Glance

Snowflake’s security architecture operates at several distinct layers:

Network Policies

A network policy controls which IP addresses can connect to your Snowflake account. It is the first line of defence — checked even before authentication is attempted.

How Network Policies Work

Network Policy Enforcement Flow

Flowchart showing what happens when a client attempts to connect to Snowflake. Step 1: Client sends connection request with its IP address. Step 2: Snowflake checks if a user-level network policy is applied to this user. If yes, it evaluates that policy. If no, it checks the account-level network policy. Step 3: The IP is checked against the BLOCKED_IP_LIST first — if found, the connection is refused. Step 4: The IP is checked against the ALLOWED_IP_LIST. If found (or if the list is empty), the connection proceeds to authentication. If not found, the connection is refused. Step 5: Authentication proceeds (username/password, MFA, SSO, etc.).

Rules for Network Policies

• If ALLOWED_IP_LIST is empty, all IP addresses are allowed (no restriction).
• If an IP appears in both ALLOWED_IP_LIST and BLOCKED_IP_LIST, the BLOCKED_IP_LIST takes precedence — the IP is denied.
• User-level network policies override account-level network policies for that specific user.
• Only ACCOUNTADMIN (or a role with the ATTACH POLICY privilege) can apply a network policy.

CREATE NETWORK POLICY Syntax

1-- Create a network policy with an allowed IP range and a blocked IP
2CREATE NETWORK POLICY corporate_policy
3ALLOWED_IP_LIST = (
4  '203.0.113.0/24',    -- Corporate office CIDR range
5  '198.51.100.10',     -- Specific VPN endpoint IP
6  '10.0.0.0/8'         -- Internal network range
7)
8BLOCKED_IP_LIST = (
9  '203.0.113.100'      -- Blocked specific host within allowed range
10);
11
12-- View all network policies in the account
13SHOW NETWORK POLICIES;
14
15-- Inspect the details of a specific policy
16DESCRIBE NETWORK POLICY corporate_policy;
17
18-- Modify an existing network policy
19ALTER NETWORK POLICY corporate_policy
20SET ALLOWED_IP_LIST = (
21  '203.0.113.0/24',
22  '198.51.100.10',
23  '10.0.0.0/8',
24  '172.16.0.0/12'   -- Add new range for branch offices
25);
26
27-- Drop a network policy (fails if currently applied)
28DROP NETWORK POLICY corporate_policy;

Applying Network Policies

Network policies can be applied at two levels: account-wide or to a specific user.

1-- Apply a network policy at the ACCOUNT level
2-- All users connecting to this account are subject to this policy
3-- (unless they have a user-level policy that overrides it)
4ALTER ACCOUNT SET NETWORK_POLICY = corporate_policy;
5
6-- Remove the account-level network policy
7ALTER ACCOUNT UNSET NETWORK_POLICY;
8
9-- Apply a network policy to a SPECIFIC USER
10-- This overrides the account-level policy for this user only
11ALTER USER alice SET NETWORK_POLICY = developer_policy;
12
13-- Remove the user-level network policy
14-- User then falls back to the account-level policy
15ALTER USER alice UNSET NETWORK_POLICY;
16
17-- View what policy is applied to a user
18DESCRIBE USER alice;
19
20-- View the current account-level network policy
21SHOW PARAMETERS LIKE 'NETWORK_POLICY' IN ACCOUNT;

SHOW and DESCRIBE Commands for Network Policies

1-- List all network policies defined in the account
2SHOW NETWORK POLICIES;
3
4-- Describe a specific policy to see its IP lists
5DESCRIBE NETWORK POLICY corporate_policy;
6
7-- See which network policy is active at account level
8SHOW PARAMETERS LIKE '%NETWORK%' IN ACCOUNT;
9
10-- See which network policy a specific user has assigned
11SHOW PARAMETERS LIKE '%NETWORK%' IN USER alice;

Private Connectivity (Business Critical+)

For organisations with strict security requirements, Snowflake supports private connectivity that routes traffic entirely within the cloud provider’s network — bypassing the public internet.

Private Link vs Public Internet Connectivity to Snowflake

Side-by-side diagram comparing two connectivity models. On the left: Standard connectivity. Client in a corporate VPC sends traffic over the public internet to Snowflake's public endpoint. Traffic is encrypted with TLS but traverses multiple public network hops. On the right: Private Link connectivity. Client in a corporate VPC connects to a VPC endpoint (AWS) or Private Endpoint (Azure) or Service Attachment (GCP) within their own cloud environment. Traffic travels entirely within the cloud provider's internal backbone network and arrives at Snowflake's private endpoint without ever touching the public internet. Both paths encrypt data in transit, but Private Link eliminates public internet exposure entirely.

Tri-Secret Secure (Business Critical+)

Tri-Secret Secure is an advanced encryption option where customer-managed keys are combined with Snowflake-managed keys to create a composite encryption key. Neither Snowflake nor the customer alone can decrypt the data.

Tri-Secret Secure Key Hierarchy

Diagram illustrating the Tri-Secret Secure key model. At the top is the composite encryption key, which is derived from two components: 1) The Snowflake Master Key, held and managed by Snowflake internally. 2) The Customer Master Key, held by the customer in their cloud KMS (AWS KMS, Azure Key Vault, or GCP Cloud KMS). The composite key is created by combining both components at query time. Data encrypted with this composite key cannot be decrypted by Snowflake alone (they only have half the key) and cannot be decrypted by the customer alone (they only have the other half). To revoke Snowflake's access to data, the customer simply rotates or deletes their key in the KMS — Snowflake can no longer form the composite key and all data becomes inaccessible.

Supported KMS Providers for Tri-Secret Secure

Encryption — In Transit and At Rest

In Transit

• All communication between Snowflake clients and the Snowflake service is encrypted using TLS 1.2 or higher.
• This applies to the Snowflake web UI, SnowSQL CLI, ODBC/JDBC drivers, Python connector, and all other client interfaces.
• Encryption in transit is automatic — it cannot be disabled.

At Rest

• All data stored in Snowflake’s cloud storage layer (S3, Azure Blob, GCS) is encrypted using AES-256.
• Encryption at rest is automatic — no configuration is required.
• Snowflake uses a hierarchical key model: file keys encrypt data files, column master keys protect file keys, account master keys protect column master keys.

1-- Check encryption settings at the account level
2SHOW PARAMETERS LIKE '%ENCRYPT%' IN ACCOUNT;
3
4-- View data retention settings (related to security posture)
5SHOW PARAMETERS LIKE '%DATA_RETENTION%' IN ACCOUNT;
6
7-- Check if periodic rekeying is enabled (Enterprise+)
8SHOW PARAMETERS LIKE '%REKEY%' IN ACCOUNT;

Periodic Rekeying (Enterprise+)

Periodic rekeying is a feature where Snowflake automatically re-encrypts stored data with new encryption keys on a scheduled basis. This limits the exposure window if an encryption key is ever compromised.

Multi-Factor Authentication (MFA)

Snowflake integrates with Duo Security to provide MFA for user accounts. MFA adds a second authentication factor beyond username and password.

MFA Enrolment and Enforcement

1-- Check MFA status for a user
2DESCRIBE USER alice;
3-- Look for ext_authn_duo in the output
4
5-- As ACCOUNTADMIN, require MFA for a specific user
6-- (User must have already enrolled via the Snowflake UI or SnowSQL)
7ALTER USER alice SET MINS_TO_BYPASS_MFA = 0;
8
9-- Allow MFA token caching for a session (reduces repeated prompts)
10-- Set the number of minutes MFA tokens can be cached per session
11ALTER USER alice SET MINS_TO_BYPASS_MFA = 60;
12
13-- Disable MFA token caching (prompt on every session)
14ALTER USER alice SET MINS_TO_BYPASS_MFA = 0;
15
16-- Check MFA-related parameters across the account
17SHOW PARAMETERS LIKE '%MFA%' IN ACCOUNT;

MFA Token Caching

MFA token caching reduces the frequency of MFA prompts. When enabled, a user authenticates with MFA once and their token is cached for a configurable number of minutes. Within that window, subsequent connections do not require a new MFA prompt.

Setting Up Security Integrations

Security integrations configure external authentication providers for OAuth and SAML-based Single Sign-On (SSO).

1-- Create a security integration for Okta SAML SSO
2CREATE SECURITY INTEGRATION okta_sso
3TYPE = SAML2
4ENABLED = TRUE
5SAML2_ISSUER = 'http://www.okta.com/exkXXXXXXXXXXX'
6SAML2_SSO_URL = 'https://mycompany.okta.com/app/snowflake/exkXXX/sso/saml'
7SAML2_PROVIDER = 'OKTA'
8SAML2_X509_CERT = 'MIIDnjCCAoagAwIBAgIGAXXXXXXX...'
9SAML2_SP_INITIATED_LOGIN_PAGE_LABEL = 'Okta SSO'
10SAML2_ENABLE_SP_INITIATED = TRUE;
11
12-- Create a security integration for OAuth (e.g., for Tableau)
13CREATE SECURITY INTEGRATION tableau_oauth
14TYPE = OAUTH
15ENABLED = TRUE
16OAUTH_CLIENT = TABLEAU_DESKTOP;
17
18-- Create a custom OAuth integration for a partner application
19CREATE SECURITY INTEGRATION my_app_oauth
20TYPE = OAUTH
21ENABLED = TRUE
22OAUTH_CLIENT = CUSTOM
23OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
24OAUTH_REDIRECT_URI = 'https://myapp.example.com/oauth/callback'
25OAUTH_ISSUE_REFRESH_TOKENS = TRUE
26OAUTH_REFRESH_TOKEN_VALIDITY = 86400;
27
28-- View all security integrations
29SHOW INTEGRATIONS;
30
31-- Describe a specific security integration
32DESCRIBE INTEGRATION okta_sso;

Network Security Setup — Step-by-Step

-- Document your IP ranges first (no SQL needed here)
-- Example ranges:
-- Corporate HQ: 203.0.113.0/24
-- VPN endpoint: 198.51.100.10
-- Internal network: 10.0.0.0/8
-- Blocked IP (compromised device): 203.0.113.100

CREATE NETWORK POLICY corporate_access_policy
ALLOWED_IP_LIST = (
  '203.0.113.0/24',
  '198.51.100.10',
  '10.0.0.0/8'
)
BLOCKED_IP_LIST = (
  '203.0.113.100'
);

-- Verify the policy was created correctly
DESCRIBE NETWORK POLICY corporate_access_policy;

-- Apply account-level network policy
ALTER ACCOUNT SET NETWORK_POLICY = corporate_access_policy;

-- Confirm the policy is applied
SHOW PARAMETERS LIKE 'NETWORK_POLICY' IN ACCOUNT;

-- Policy for developers who work remotely
CREATE NETWORK POLICY developer_policy
ALLOWED_IP_LIST = (
  '203.0.113.0/24',   -- Office
  '0.0.0.0/0'          -- Allow any IP (for remote work)
);

-- Apply to specific developer users
ALTER USER alice SET NETWORK_POLICY = developer_policy;
ALTER USER bob SET NETWORK_POLICY = developer_policy;

-- Service accounts: create tightly scoped policies
CREATE NETWORK POLICY etl_service_policy
ALLOWED_IP_LIST = ('10.5.0.10', '10.5.0.11');

ALTER USER etl_service_account SET NETWORK_POLICY = etl_service_policy;

-- After user has enrolled in MFA via Snowflake UI,
-- set token caching to 0 for admin accounts (always prompt)
ALTER USER admin_alice SET MINS_TO_BYPASS_MFA = 0;

-- For regular analysts, allow 60-minute MFA token caching
ALTER USER analyst_bob SET MINS_TO_BYPASS_MFA = 60;

-- Verify MFA configuration for a user
DESCRIBE USER admin_alice;

-- Example: Okta SAML integration
CREATE SECURITY INTEGRATION okta_integration
TYPE = SAML2
ENABLED = TRUE
SAML2_ISSUER = 'http://www.okta.com/exkYOUR_APP_ID'
SAML2_SSO_URL = 'https://yourcompany.okta.com/app/snowflake/exkYOUR_APP_ID/sso/saml'
SAML2_PROVIDER = 'OKTA'
SAML2_X509_CERT = 'YOUR_CERTIFICATE_HERE'
SAML2_ENABLE_SP_INITIATED = TRUE;

SHOW INTEGRATIONS;

Quiz — Network Policy Precedence

Quiz — Private Link and Encryption

Comparing Snowflake Security Editions

Encryption Architecture in Detail

Snowflake uses a hierarchical key model to manage encryption:

Account Master Key (AMK)
  └── Table Master Keys (TMK)
        └── File Keys (FK)
              └── Encrypted data files (in S3 / Azure Blob / GCS)

• File Keys (FK) are unique per micro-partition data file. They encrypt the actual data.
• Table Master Keys (TMK) encrypt the file keys. One per table.
• Account Master Key (AMK) encrypts the table master keys. One per account.
• With Tri-Secret Secure, the AMK itself is a composite of Snowflake’s key and the customer’s KMS key.

1-- View account-level security parameters including encryption
2SHOW PARAMETERS IN ACCOUNT;
3
4-- Check if SSMS (server-side encryption at rest) is configured
5SHOW PARAMETERS LIKE '%ENCRYPTION%' IN ACCOUNT;
6
7-- Periodic rekeying configuration
8-- (Managed by Snowflake for Enterprise+; no explicit SQL to enable)
9-- Check if rekeying is active:
10SHOW PARAMETERS LIKE '%REKEY%' IN ACCOUNT;
11
12-- Key pair authentication (alternative to password + MFA for programmatic access)
13-- Generate RSA key pair outside Snowflake, then register the public key:
14ALTER USER service_account
15SET RSA_PUBLIC_KEY = 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC...';
16
17-- Verify key pair is registered
18DESCRIBE USER service_account;

Network Security Cheat Sheet

Summary

Network security in Snowflake is a layered model. For the COF-C02 exam, remember these key points:

1. Network policies restrict access by IP address. ALLOWED_IP_LIST and BLOCKED_IP_LIST are evaluated on every connection attempt — before authentication.
2. The block list always wins: an IP in both lists is blocked.
3. User-level policies override account-level policies for that specific user.
4. Private connectivity (PrivateLink / Private Service Connect) requires Business Critical edition and keeps traffic entirely within the cloud provider’s network.
5. Tri-Secret Secure requires Business Critical edition and uses a composite key where neither Snowflake nor the customer alone can decrypt data.
6. All editions include automatic AES-256 encryption at rest and TLS 1.2+ in transit — no configuration needed.
7. Periodic rekeying is an Enterprise+ feature that automatically re-encrypts data with new keys.
8. MFA uses Duo Security. Token caching (MINS_TO_BYPASS_MFA) reduces prompts for interactive users.
9. Security integrations enable SAML2 SSO and OAuth for partner tools and custom applications.
10. Key-pair authentication is the recommended approach for service accounts and programmatic access.